AI, Fill This Form: A Simple and Effective Data Exfiltration Attack on LLM-Based Browser Extensions Without Prompt Injection - Santos, Victor Garcia dos; Terada, Routo; Hayashi, Victor Takashi; Ferreira, Bryan Kano (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg_estendido.2026.33823, 2026)
LLM-based browser extensions execute web tasks without the user supervising each interaction. We introduce Ghost Field Exfiltration (GFE), a data exfiltration attack against this class of system that requires no prompt injection. The attack exploits the asymmetry between what the user sees in a rendered form and what the agent processes in the Document Object Model (DOM): a malicious page presents a small visible form while embedding additional input fields concealed via CSS or accessibility-layer techniques, which the agent fills with the user’s data alongside the legitimate inputs. We evaluate GFE across 300 controlled experiments on three Claude models accessed through the Claude for Chrome extension. Full exfiltration ranges from 19% on Opus 4.6 to 64% on Haiku 4.5, with Personally Identifiable Information (PII) reaching 95% on the smaller model. Our analysis indicates that the models defenses correlate strongly with recognition of sensitive data categories rather than with structural detection of the abuse, indicating that agent-layer safeguards are needed to comprehensively address this class of attack.